the “ADPlugin: Setting Computer Password FAILED” error when binding to AD

there’ve been a couple of posts about this but having done extensive troubleshooting on this and solving it i thought i’d share our conclusion….

if you find the error “ADPlugin: Setting Computer Password FAILED” in the ADPlugin debug log then it indicates a privileges issue with the AD domain admin account relative to the specific OU – it seems that AD DOES NOT RESPECT INHERITED access rights correctly when attempting to bind from a Mac client

the solution is to EXPLICITLY assign full control access directly to the target OU for the domain admin account you are using – in other words although the GUI will indicate that a level 1 domain admin has full control by virtue of being in that group, you need to create a new entry for the user account in the properties for the OU and then give that named entry full control

i hope that helps (it gave me a headache for a week!)

cheers

seth